From 177eb71c52069712bcc9fe14c70e079cc2671a80 Mon Sep 17 00:00:00 2001
From: artnaseef <artnaseef@apache.org>
Date: Mon, 31 Aug 2020 09:48:13 -0700
Subject: [PATCH] Properly encode the copy/move message URL.

(cherry picked from commit 4450c17c1c836a1daa7541dcb944f35798258197)
---
 activemq-web-console/src/main/webapp/message.jsp | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/activemq-web-console/src/main/webapp/message.jsp b/activemq-web-console/src/main/webapp/message.jsp
index 262dc5e688..132d596d68 100644
--- a/activemq-web-console/src/main/webapp/message.jsp
+++ b/activemq-web-console/src/main/webapp/message.jsp
@@ -234,9 +234,17 @@ function confirmAction(id, action) {
 		return;
 	}
 	var value = select.options[selectedIndex].value;
-	var url = action + ".action?destination=" + value;
-	url += "&JMSDestination=${requestContext.messageQuery.JMSDestination}";
-	url += "&messageId=${row.JMSMessageID}&JMSDestinationType=queue&secret=${sessionScope['secret']}";
+	var url = action + ".action?destination=" + encodeURIComponent(value);
+
+	var url = action +
+		"<c:url value=".action">
+                     <c:param name="JMSDestination" value="${requestContext.messageQuery.JMSDestination}" />
+                     <c:param name="messageId" value="${row.JMSMessageID}" />
+                     <c:param name="JMSDestinationType" value="queue" />
+                     <c:param name="secret" value='${sessionScope["secret"]}' />
+                 </c:url>";
+	url = url + "&destination=" + encodeURIComponent(value);
+
 	if (confirm("Are you sure?"))
 	  location.href=url;
 }